A new dawn in privacy is well underway in Asia-Pacific (APAC). With the region’s legislation on privacy projected to surge 25% by Q4 2023 since 2021, several jurisdictions are set to implement data privacy laws to protect sensitive personal data for the first time. The amendments herald a shift in punitive measures while conferring certain rights on data subjects, namely the right to data portability and the right to be excluded from automated decision-making. It further tightens the regulatory screws on the overseas transfer of personal data belonging to data subjects. To date, it’s widely recognized as one of the world’s most stringent privacy regimes thanks to onerous requirements like ‘opt-in’ consent, prior notification, and the weighty sanctions applicable in violations thereof. It applies to data handlers, individuals, organizations, public agencies, or juridical persons — in fact, anyone who handles data subject's personal information either by themselves or through a third party to pursue their business activities. Consequently, companies operating in South Korea must comply. Foreign companies targeting South Korean data subjects (or any data subjects located within the South Korean `jurisdiction) must also maintain compliance. This amendment was initiated on 4th Feb 2020 and took effect on August 5th, 2020. But beyond integrating parts of the Network Act and the National Credit Information Act (more on that later), a notable feature of this PIPA amendment is the vesting of all data protection matters in the PIPC (The Personal Information Protection Commission). Joins the global trend of economic sanctions, replacing criminal sanctions with more administrative penalties (fines), save for certain newly-introduced violations like obstruction of investigations. Piles on the current requirements for transferring sensitive personal information overseas with additional legal bases. In any case, other parts of the PIPA still apply to online service providers. Where a data breach occurs, the GDPR requires companies to notify the relevant authority before notifying data subjects. South Korea's PIPA upends this order; companies must inform data subjects about the leakage “without delay” before notifying the relevant authority. The PIPA requires companies to obtain the data subject's consent to have personal information transferred overseas. In contrast, the GDPR allows international personal data transfer without the data subject's approval once an adequacy decision or appropriate safeguard mechanism exists. Concerning the rights of a data subject, the PIPA guarantees the right of access, correction, and deletion. That being said, the GDPR goes further to prescribe the right to transfer personal information to other organizations, the right to limit personal information processing, the right to refuse profiling, as well as the right to be forgotten (permanently deleted from storage). The GDPR imposes higher fines for non-compliance, up to 4% of an organization's annual global revenue or €20 million (whichever is higher), while PIPA imposes fines up to KRW 3 billion (approximately USD 2.2 million) or 3% of the company’s annual revenue, whichever is higher. The PIPA only requires public institutions to conduct data privacy impact assessments, while the GDPR requires private companies handling a considerable volume of personal data to do the same. The GDPR applies to the personal information processing of data subjects within the European Union (EU), regardless of where the personal information processing takes place, while PIPA applies to the personal information processing of data subjects based in South Korea, regardless of the nationality or residence of the individuals. While the GDPR and PIPA define personal data broadly to include any information that can identify an individual, PIPA has a slightly narrower definition. The point being, PIPA does not consider pseudonymized data to be personal information if the data cannot be used to identify an individual. The legal framework for data privacy in South Korea rests on the Personal Information Protection Act (PIPA), the primary legislation governing the collection, use, and disclosure of personal information in South Korea. It applies to data handlers; public and private sector entities, and foreign organizations that handle the personal information of Korean citizens. Restrictions also abound. For instance, credit reporting agencies are prohibited from disclosing credit information to third parties without the data subject's consent, except in an attempt to meet legal or regulatory requirements. In keeping with its objective to protect sensitive personal data, it also outlaws the use of credit information for discriminatory purposes. E.g., denying someone a job or housing based solely on their credit history. South Korea has laws regulating various media and expression forms. There's the National Security Act (as amended in 2020), The Basic Press Act, and Article 21 which spells out limitations on freedom of speech within the country. These laws are administered through regulatory bodies like the KCC and the KCSC.The KCC (Korea Communications Commission) oversees and manages the broadcasting and telecommunications sector. On the other hand, the KCSC (Korea Communications Standards Commission) is a committee inside the KCC whose major regulatory remit is the Internet. The KSCS is designed to monitor internet content, especially ethical standards. It's the body with the power to enforce internet standards on online service providers and content hosts. The GDPR is an EU law that governs data privacy and protection. While GDPR applies to entities within the EU, it also applies to entities outside the EU processing the personal information of individuals in the EU. South Korea has its own legal framework to protect personal data, such as the Personal Information Protection Act (PIPA). However South Korea is not part of the EU and not subject to GDPR unless when offering goods or services to individuals in the EU or monitoring their behavior. In such cases, South Korean companies would need to comply with GDPR when processing the personal data of EU individuals. It's also worth noting that South Korea and the EU have signed a free trade agreement that includes provisions for data protection. The agreement encourages both sides to adopt data protection regulations that are compatible with each other, which could lead to closer alignment between GDPR and South Korea's data protection laws in the future. Content writer and copywriter for Legal tech, IT Compliance, MarTech, and Digital Transformation.